ERP5Storage: support non editable document in get/put methods.

Put action is not send anymore by ERP5 if document is not editable.
See: nexedi/erp5@c71cfd66

src/jio.storage/erp5storage.js

@@ -82,7 +82,8 @@
           form_data_json = {},
           field,
           key,
-          prefix_length;
+          prefix_length,
+          result;
 
         form_data_json.form_id = {
           "key": [form.form_id.key],
@@ -110,11 +111,15 @@
           }
         }
 
-        return {
-          action_href: form._actions.put.href,
+        result = {
           data: converted_json,
           form_data: form_data_json
         };
+        if (form.hasOwnProperty('_actions') &&
+            form._actions.hasOwnProperty('put')) {
+          result.action_href = form._actions.put.href;
+        }
+        return result;
       });
   }
 
@@ -272,6 +277,12 @@
             }
           }
         }
+        if (!result.hasOwnProperty('action_href')) {
+          throw new jIO.util.jIOError(
+            "ERP5: can not modify document: " + id,
+            403
+          );
+        }
         return context.putAttachment(
           id,
           result.action_href,

test/jio.storage/erp5storage.tests.js

@@ -124,11 +124,6 @@
             form_id: {
               key: "form_id",
               "default": "Base_view"
-            },
-            "_actions": {
-              put: {
-                href: "one erp5 url"
-              }
             }
           }
         }
@@ -229,11 +224,6 @@
               "default": "foobar",
               editable: true,
               type: "StringField"
-            },
-            "_actions": {
-              put: {
-                href: "one erp5 url"
-              }
             }
           }
         }
@@ -1726,6 +1716,71 @@
       });
   });
 
+  test("put non editable ERP5 document", function () {
+    var id = "person_module/20150119_azerty",
+      traverse_url = domain + "?mode=traverse&relative_url=" +
+                     encodeURIComponent(id) + "&view=bar_view",
+      document_hateoas = JSON.stringify({
+        // Kept property
+        "title": "foo",
+        // Remove all _ properties
+        "_bar": "john doo",
+        "_links": {
+          type: {
+            name: "Person"
+          }
+        },
+        "_embedded": {
+          "_view": {
+            form_id: {
+              key: "form_id",
+              "default": "Base_view"
+            },
+            my_title: {
+              key: "field_my_title",
+              "default": "foo",
+              editable: true,
+              type: "StringField"
+            }
+          }
+        }
+      }),
+      server = this.server;
+
+    this.server.respondWith("GET", domain, [200, {
+      "Content-Type": "application/hal+json"
+    }, root_hateoas]);
+    this.server.respondWith("GET", traverse_url, [200, {
+      "Content-Type": "application/hal+json"
+    }, document_hateoas]);
+
+    stop();
+    expect(12);
+
+    this.jio.put(id, {title: "barè"})
+      .fail(function (error) {
+        ok(error instanceof jIO.util.jIOError);
+        equal(error.message, "ERP5: can not modify document: " + id);
+        equal(error.status_code, 403);
+
+        equal(server.requests.length, 2);
+        equal(server.requests[0].method, "GET");
+        equal(server.requests[0].url, domain);
+        equal(server.requests[0].requestBody, undefined);
+        equal(server.requests[0].withCredentials, true);
+        equal(server.requests[1].method, "GET");
+        equal(server.requests[1].url, traverse_url);
+        equal(server.requests[1].requestBody, undefined);
+        equal(server.requests[1].withCredentials, true);
+      })
+      .fail(function (error) {
+        ok(false, error);
+      })
+      .always(function () {
+        start();
+      });
+  });
+
   /////////////////////////////////////////////////////////////////
   // erp5Storage.post
   /////////////////////////////////////////////////////////////////